From 6668ed271eaefaa63e686bdfbedaeb7b8e492722 Mon Sep 17 00:00:00 2001 From: Kumar Kartikeya Dwivedi Date: Fri, 4 Sep 2026 10:43:19 +0200 Subject: selftests/bpf: Reject graph kptr use after RCU unlock Add a sleepable verifier test that loads a graph-node local kptr in an explicit RCU read-side critical section, then passes its node to bpf_rbtree_remove() after the section ends. Before the verifier fix, the stale NON_OWN_REF flag makes the node look like a live borrowed reference and the program is accepted. After the fix, the pointer is demoted without NON_OWN_REF and the graph kfunc argument is rejected. Also exercise a graph kptr loaded while a spin lock provides implicit RCU protection. The pointer must be invalidated when the lock is released, which guards the required ordering between non-owning-reference invalidation and RCU demotion. Update the existing fault-protected load test state description. The post-unlock pointer no longer carries NON_OWN_REF, but remains readable because the load is rewritten to use BPF_PROBE_MEM. Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20260904084325.52250-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov --- drivers/gpio/gpio-max7301.c | 104 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 drivers/gpio/gpio-max7301.c (limited to 'drivers/gpio/gpio-max7301.c') diff --git a/drivers/gpio/gpio-max7301.c b/drivers/gpio/gpio-max7301.c new file mode 100644 index 000000000..11813f41d --- /dev/null +++ b/drivers/gpio/gpio-max7301.c @@ -0,0 +1,104 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2006 Juergen Beisert, Pengutronix + * Copyright (C) 2008 Guennadi Liakhovetski, Pengutronix + * Copyright (C) 2009 Wolfram Sang, Pengutronix + * + * Check max730x.c for further details. + */ + +#include +#include +#include +#include +#include +#include +#include + +/* A write to the MAX7301 means one message with one transfer */ +static int max7301_spi_write(struct device *dev, unsigned int reg, + unsigned int val) +{ + struct spi_device *spi = to_spi_device(dev); + u16 word = ((reg & 0x7F) << 8) | (val & 0xFF); + + return spi_write_then_read(spi, &word, sizeof(word), NULL, 0); +} + +/* A read from the MAX7301 means two transfers; here, one message each */ + +static int max7301_spi_read(struct device *dev, unsigned int reg) +{ + int ret; + u16 word; + struct spi_device *spi = to_spi_device(dev); + + word = 0x8000 | (reg << 8); + ret = spi_write_then_read(spi, &word, sizeof(word), &word, + sizeof(word)); + if (ret) + return ret; + return word & 0xff; +} + +static int max7301_probe(struct spi_device *spi) +{ + struct max7301 *ts; + int ret; + + /* bits_per_word cannot be configured in platform data */ + spi->bits_per_word = 16; + ret = spi_setup(spi); + if (ret < 0) + return ret; + + ts = devm_kzalloc(&spi->dev, sizeof(struct max7301), GFP_KERNEL); + if (!ts) + return -ENOMEM; + + ts->read = max7301_spi_read; + ts->write = max7301_spi_write; + ts->dev = &spi->dev; + + ret = __max730x_probe(ts); + return ret; +} + +static void max7301_remove(struct spi_device *spi) +{ + __max730x_remove(&spi->dev); +} + +static const struct spi_device_id max7301_id[] = { + { "max7301", 0 }, + { } +}; +MODULE_DEVICE_TABLE(spi, max7301_id); + +static struct spi_driver max7301_driver = { + .driver = { + .name = "max7301", + }, + .probe = max7301_probe, + .remove = max7301_remove, + .id_table = max7301_id, +}; + +static int __init max7301_init(void) +{ + return spi_register_driver(&max7301_driver); +} +/* register after spi postcore initcall and before + * subsys initcalls that may rely on these GPIOs + */ +subsys_initcall(max7301_init); + +static void __exit max7301_exit(void) +{ + spi_unregister_driver(&max7301_driver); +} +module_exit(max7301_exit); + +MODULE_AUTHOR("Juergen Beisert, Wolfram Sang"); +MODULE_LICENSE("GPL v2"); +MODULE_DESCRIPTION("MAX7301 GPIO-Expander"); -- cgit v1.3.1